ClawHub
Back to skill

Security audit

交易分析入门工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is a trading analysis helper, but it asks for broad execution/write authority and uses overly broad activation language that could pull it into unrelated tasks.

Review this skill carefully before installing. Use it only for single-symbol technical analysis, install dependencies in an isolated virtual environment with pinned versions if possible, and avoid letting its broad keywords route unrelated data, automation, or machine-learning tasks to a skill with exec/write authority.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:136
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:136 (also referenced individually at lines 231–234)
Vulnerability Type: Unpinned and unverified Python dependencies
Risk Level: Medium

bash
pip install yfinance pandas numpy ta

Technical Analysis

The Skill directs users or AI agents to install four packages from the configured Python Package Index without exact version constraints, cryptographic hashes, or a reviewed lockfile. Package resolution therefore depends on mutable upstream repositories and includes unconstrained transitive dependencies.

If an upstream package, maintainer account, package index, configured mirror, or transitive dependency is compromised, installation can execute attacker-controlled package build or installation logic with the privileges of the invoking process. The instruction also prevents reproducible dependency resolution and can introduce unexpected behavior or vulnerabilities when new package versions are published.

No evidence establishes that the named packages are currently malicious. The confirmed weakness is the unsafe, unverified dependency installation process.

Attack Path

  1. A user or agent follows the installation instruction in SKILL.md.
  2. pip contacts its configured package index or mirror and resolves the latest compatible versions of the named packages and their transitive dependencies.
  3. An attacker compromises an upstream release, dependency, maintainer account, index, or mirror.
  4. The compromised component is selected because the Skill provides no version or hash verification.
  5. Malicious package installation or build logic executes in the local Python environment.
  6. The payload gains the same filesystem, network, process, and credential access available to the account running pip.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the invoking user or agent. The accessible scope may in ...[truncated 388 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the direct installation command with a reviewed dependency manifest containing exact versions.
  2. Generate and retain cryptographic hashes for every direct and transitive dependency.
  3. Install with hash enforcement, for example:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Use a lockfile generation workflow such as pip-tools, and review dependency changes before updating the lockfile.
  5. Perform installation inside a dedicated, non-privileged virtual environment rather than the system Python environment.
  6. Configure an approved package index or internal artifact repository and require TLS certificate verification.
  7. Add automated dependency vulnerability and integrity scanning to the release process.
  8. Document trusted versions of yfinance, pandas, numpy, and ta, including all resolved transitive dependencies.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill advertises extremely broad trigger terms such as data analysis, reporting, statistics, visualization, automation, machine learning, natural language, and finance, far beyond the actual Vegas Channel trading purpose. In an agent environment, this can cause the skill to activate on unrelated user requests and unnecessarily expose exec/write-capable functionality, increasing the chance of unsafe tool use or prompt-routing abuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The capability matrix states '多标的分析 | 不支持' for the free version at L060, indicating limited single-asset analysis. Later, L072 says the core execution supports '创建/查询/导出操作', which broadens the documented behavior beyond the earlier analysis-only scope and conflicts with the stated free-version limitations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The capability coverage section enumerates an excessively broad keyword list and claims support for many loosely related scenarios, creating unclear activation boundaries. Because the skill declares powerful tools including read, exec, and write, overbroad matching can cause the agent to invoke this skill for unrelated prompts, making the context materially more dangerous than a passive documentation-only skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The description at L012/L016 narrows intended use to analysis, reporting, and visualization, and explicitly says it is not suitable for real-time stream processing. However, L073 claims coverage for '企业团队和自动化工作流场景等', which expands the intended use substantially and creates a documentation-level inconsistency about the skill's actual scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.